Do Not Sell My Personal Information: How to Opt Out Under CCPA

If you live in California, you can tell any covered business to stop selling or sharing your personal information by clicking the “Do Not Sell or Share My Personal Information” link that must appear in the footer or header of its website, or by turning on an automated browser signal that sends the same request to every site you visit. The business then has 15 business days to comply, and it cannot charge you more, give you worse service, or otherwise punish you for asking. This right comes from the California Consumer Privacy Act, and it applies whether the business receives cash for your data or trades it for advertising services and other valuable considerations.

How to Send the Request

A covered business has to offer at least two ways to opt out.¹ For businesses that collect data online, that means an opt-out preference signal plus one of the following: an interactive web form reached through the “Do Not Sell or Share My Personal Information” link, an alternative opt-out link, or instructions in the privacy policy.

The process is supposed to be simple. You cannot be forced to create an account to submit the request, and the business cannot impose the kind of identity verification it would use for a deletion request.² It can ask enough to figure out which data is yours, but no more.

One trap worth knowing: a cookie banner is not a valid opt-out on its own.¹ Cookie tools govern collection; the opt-out has to specifically cover the sale and sharing of personal information.

Global Privacy Control

The most efficient option is the Global Privacy Control, an automated signal built into browsers like Mozilla Firefox, DuckDuckGo, and Brave, and available as an extension for others. Once you turn it on, GPC quietly tells every participating website that you are opting out of the sale and sharing of your personal information, and covered businesses are legally required to honor it.³ One setting change replaces thousands of individual clicks.

Having Someone Else Send It for You

You can also authorize an agent to submit opt-out requests on your behalf. The business is allowed to ask the agent for your signed written permission before acting.⁴ A GPC signal from your own browser counts as coming from you directly, not from an agent, so no paperwork is needed for the automated route.

What the Business Has to Do After You Ask

Once your request arrives, the business must stop selling and sharing your personal information as soon as feasibly possible and no later than 15 business days after receiving it.¹ It also has to notify third parties it sold or shared your data with during the gap between your request and its compliance.

After you opt out, the business must wait at least 12 months before asking you to opt back in.² If the company is later acquired, the buyer has to honor your existing opt-out.⁵

What Counts as Selling or Sharing

The CCPA’s definition of “selling” is wider than most people expect. A sale happens any time a business transfers your personal information to a third party for monetary or other valuable consideration.⁶ Handing over your data in return for free analytics tools or advertising services counts, even with no money involved.

“Sharing” is a separate category the law added later, and it targets one specific practice: transferring your personal information to a third party for cross-context behavioral advertising.² That is the tracking that lets one site’s search for running shoes turn into running-shoe ads on every other site you visit. Whether the business is paid for the transfer is irrelevant; sharing for that purpose triggers the opt-out.

Personal information itself is defined broadly. It covers not just your name, email, and IP address, but browsing history, purchase records, location data, employment information, and the pseudonymous profiles advertisers build tied to user IDs rather than real names.⁷ If the data can be linked back to you or your household, even indirectly, the CCPA treats it as personal information.

Not every transfer is a sale or share. Sending data to a service provider bound by a written contract that restricts its use, sending data at your direction, or transferring data as part of a merger or acquisition (when the buyer honors the original privacy commitments) all sit outside the definition.⁶

What Opting Out Does Not Do

An opt-out stops future sales and sharing. It does not delete the data the business already holds, and it does not undo transfers that already happened. To have your data erased, submit a separate deletion request; the CCPA provides that right under a different section.⁸ You can also ask a business to correct inaccurate information it holds about you. Many people file opt-out, deletion, and correction requests together.

There is also a separate “Limit the Use of My Sensitive Personal Information” link you may see on the same websites. Sensitive personal information is a narrower category that includes Social Security numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, genetic and biometric data, health information, and the contents of private messages.⁷ The two rights operate independently. Using the “Do Not Sell or Share” link does not automatically limit how the business uses your sensitive data, so if you want both, click both.

The Business Cannot Retaliate

Opting out is not supposed to cost you anything. The CCPA bars businesses from denying goods or services, charging different prices, providing lower quality service, or even suggesting worse treatment because you exercised a privacy right.⁹ The same protection covers employees and independent contractors.

A business can offer voluntary financial incentives such as loyalty discounts in exchange for opt-in consent to use your data, and it can charge different amounts if the difference is reasonably tied to the value your data provides. In practice, most businesses simply keep pricing and service the same.

Which Businesses Are Covered

The law applies only to for-profit businesses doing business in California that hit at least one of three thresholds: annual gross revenue above $26,625,000, buying, receiving, selling, or sharing the personal information of 100,000 or more California consumers or households annually, or deriving 50% or more of annual revenue from selling or sharing personal information.¹⁰ Entities that share common branding or control with a covered business are also included.⁶

Nonprofits and government agencies are generally outside the CCPA.² Health information already governed by HIPAA is exempt at the entity level, and financial data covered by the Gramm-Leach-Bliley Act is exempt at the data level, meaning the financial institution still owes CCPA rights on everything else it holds about you.

Special Rule for Minors

For anyone under 16, the default flips. A business cannot sell or share a minor’s personal information at all without affirmative consent first.⁵ Teens between 13 and 15 can consent for themselves; for children under 13, a parent or guardian must authorize it. A business that willfully ignores a user’s age is treated as knowing it, so pleading ignorance is not a defense.

If a Business Ignores You

Keep records. Screenshot the opt-out link, save any confirmation email, and note the date. If the business fails to honor the request within 15 business days, or if you keep seeing the same targeted ads that suggest your data is still moving, file a complaint with the California Privacy Protection Agency through its online portal or by mailing a paper form.¹¹ The CPPA accepts sworn and unsworn complaints, and you do not have to be physically in California when you file.

The agency can investigate, issue fines, and bring administrative actions. Penalties are assessed per violation, so a business that ignores thousands of opt-outs faces substantial exposure, and complaints feed both individual enforcement cases and broader industry monitoring.¹²

1
CPPA. CCPA – Effective January 1, 2026 – California Privacy Protection Agency Regulations
2
State of California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
3
State of California Department of Justice – Office of the Attorney General. Global Privacy Control (GPC)
4
California Attorney General. CCPA Regulations – Notice of Right to Opt-Out of Sale of Personal Information
5
California Legislative Information. California Code Civ – Section 1798.120
6
California Legislative Information. California Code Civ – Section 1798.140
7
privacy.ca.gov. What Is Personal Information?
8
California Legislative Information. California Code CIV – Section 1798.105
9
California Legislative Information. California Code Civ – Section 1798.125
10
California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
11
California Privacy Protection Agency. California Privacy Protection Agency Complaint Form
12
California Privacy Protection Agency. Announces 2025 Increases for CCPA Fines and Penalties